MAL-2026-13341

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-header/MAL-2026-13341.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13341
Published
2026-08-05T15:21:27Z
Modified
2026-08-05T16:51:01Z
Summary
Malicious code in dolyame-boxy-mobile-bnpl-header (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (405339008cf0f3e8c17a5e982b006c85c7f9f8110bbdc6531b4c6f71c2fbabb0)

On require of the package, shim.js assembles remote hostnames at runtime by joining split string fragments (four Cloudflare Workers subdomains such as oob-worker.cf101-adf.workers.dev / cf103-070 / cf102-baf / cf99-9b3, with a DNS-TXT fallback to sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru), downloads an opaque binary via https.get, writes it to /tmp or %TEMP% under a disguised name (.cache or dotnet_diag_.exe), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe with unref(). Execution is gated behind a lock file and DO_NOT_TRACK/ANALYTICS_OPT_OUT environment variables framed as telemetry opt-outs. The runtime-reconstructed destinations, disguised filenames, and detached background execution demonstrate deliberate concealment. Nothing in the package's stated 'device integration / BNPL header' purpose justifies fetching and executing an opaque binary from anonymous Cloudflare Workers hosts on module load.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015666",
            "import_time": "2026-08-05T16:13:29.922628426Z",
            "modified_time": "2026-08-05T15:21:27Z",
            "sha256": "405339008cf0f3e8c17a5e982b006c85c7f9f8110bbdc6531b4c6f71c2fbabb0",
            "source": "amazon-inspector",
            "versions": [
                "35.3.6"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dolyame-boxy-mobile-bnpl-header

Package

Name
dolyame-boxy-mobile-bnpl-header
View open source insights on deps.dev
Purl
pkg:npm/dolyame-boxy-mobile-bnpl-header

Affected ranges

Affected versions

35.*
35.3.6

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_shim.js",
            "sha256": "ea8ac82243fa4f7b1bed4217b5634dd516e1ecfd42e1fbea75377f9c68a783e5",
            "tlsh": "24a1865a12aa701d4bb0d7e4c7174416f65af6633380c198fb5ca9981fb712482b1efc"
        }
    ],
    "package_integrity": [
        {
            "filename": "dolyame-boxy-mobile-bnpl-header-35.3.6.tgz",
            "hashes": {
                "sha1": "64c85a8681da35dc3131862ecc7a95a39eb27a7a",
                "sha512_sri": "sha512-TloBVhwsCQE49qFjF7hVGov03zuh6L/5ybq370eq/pUChTfyZy4GCDXUmANAhpzfFwJ8rKyL4NM5gRpdHb3ngA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-mobile-bnpl-header/MAL-2026-13341.json"